SEPPmail Secure Email Gateway releases earlier than 15.0.3 contain a flaw that permits an attacker to forge a GINA‑encrypted email. The vulnerability allows the construction of an email that satisfies the encryption verification process while containing arbitrary content. Consequently, an adversary could send spoofed, apparently legitimate messages, potentially deceiving recipients, facilitating phishing, or delivering malicious payloads under the guise of a secure channel. The weakness is consistent with the Missing Authentication for Network Services enumeration (CWE‑325).

The affected product is SEPPmail Secure Email Gateway. Any installation running a version prior to 15.0.3 is vulnerable; versions 15.0.3 and later include the fix.

The CVSS base score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to create or manipulate a GINA‑encrypted email that passes validation, which likely requires knowledge of the email format and encryption scheme. The vulnerability’s potential to forge authenticated messages places it in the moderate‑to‑high risk quadrant, especially for environments that rely heavily on encrypted email for confidentiality and integrity.